Re: [sentinix-list] SnortCenter </fo
"Will Bailey" <[email protected]> Wed, 05 May 2004 09:31:22 -0700
| Newsgroups | gmane.linux.sentinix |
|---|---|
| Message-ID | <[email protected]> |
Thank you. I think this is exactly the problem. The server seems to be "overloaded" and just cannot bring things up when it comes to the SNORT alerts. It did at first, but has been worse over time. I'm sure this will be helpful to others having the same problem. I've been running Sentinix/SNORT with the default settings. I had similar problems in the past and cleared things up by reinstalling (obviously not what I wanted to do). Regards, Will >>> [email protected] 05/03/04 10:18PM >>> You normally get this when the application is unable to load the alerts. This could be because there are too many alerts in your database and the application is unable to parse the same. Another reason could be that you are logging alerts in "full" mode (detail=full). When logging alerts in "full" mode the database size increases drastically causing the same ( SnortCenter </fo) error to occur. Try using "fast" mode when logging packets (detail=fast). This will log just the packet headers and not the payload. The advantage here is that your database size decreases very drastically plus your alerts page loads pretty fast. syntax: output database: log, mysql, user=<username> password=<password> dbname=<dbname> host=<host ip / name> detail=fast Regards, Gaurav Mahendru, |---------+-----------------------------------> | | "Will Bailey" | | | <[email protected]> | | | Sent by: | | | [email protected]| | | rospect.com | | | | | | | | | 05/04/2004 06:09 AM | | | Please respond to The | | | SENTINIX Mailing List | |---------+-----------------------------------> >--------------------------------------------------------------------------------------------------------------| | | | To: <[email protected]> | | cc: (bcc: Gaurav Mahendru/INFOCOMM/RIL) | | Subject: [sentinix-list] SnortCenter </fo | | Importance: Normal Sender's OU: Reliance |------------------| | | | [ ] Confidential | | | |------------------| | >--------------------------------------------------------------------------------------------------------------| Does anyone have a clue why I get this message, and nothing else, when going to the "alerts" page in SNORT? SnortCenter </fo Regards, Will _______________________________________________ SENTINIX mailing list [email protected] http://elevenprospect.com/mailman/listinfo/sentinix _______________________________________________ SENTINIX mailing list [email protected] http://elevenprospect.com/mailman/listinfo/sentinix